Unscored severity · published Jun 21, 2013
CVE-2013-4636
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference…
–
CVSS
2%
EPSS
No
On KEV
Description
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; 5.4.5; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4636
www.php.net
http://www.php.net/ChangeLog-5.php
bugs.php.net
https://bugs.php.net/bug.php?id=64830
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability